Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

PHP patches two critical unauthenticated RCE flaws as exploitation attempts hit sensors

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · zhipu/glm-5.3-derisked · rewritten as coverage arrivesSummaries by Vani AI

PHP shipped emergency fixes for two CVSS 9.2 RCE flaws (PHP2Shell); exploitation attempts are reported but no confirmed compromises.

On October 21, 2026, PHP released fixes for CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale global state), both rated 9.2, allowing unauthenticated remote code execution on installations serving web requests, including PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. Patched releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 8.1 and older get only emergency source backports for 7.4, 8.0 and 8.1. Cloudflare and several security firms report exploitation attempts, including abuse of the session upload-progress path, but WatchTowr says it has not seen successful compromise. A leak broke the embargo a day early, and some European government sites, the Port of Rotterdam and Nintendo took services offline as a precaution. Researchers including Wiz, OpenAI and Calif reported the bugs in August after AI-assisted analysis.

Key facts
  • CVE-2026-109618 and CVE-2026-109619 both score CVSS v4.0 9.2.
  • Fixed releases: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35; only complete mitigation is updating.
  • PHP 8.1 and older are unsupported; minimal source backports exist for 7.4, 8.0 and 8.1.
  • Bugs affect nearly all PHP releases back to 5.4; risk highest with Apache mod_php.
  • Cloudflare deployed WAF rules at 3:02 am UTC; Ubuntu shipped updated packages.
  • Partial mitigations: memory_limit=-1, session.upload_progress.enabled=0, fatal_error_backtraces=0 on 8.5.
Analyze CVE-2026-109618 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Aug 1, 2026Wiz, OpenAI and Calif reported the bugs after AI-assisted analysis · SecurityWeek
  2. Oct 20, 2026PHP issued advance notice rating both flaws 9.2 · Wordfence
  3. Oct 21, 2026Leak broke embargo; Cloudflare deployed WAF rules at 3:02 am UTC · Krebs on Security
  4. Oct 21, 2026PHP released fixes a day early after disclosure leak · SecurityWeek
  5. Oct 21, 2026Multiple firms reported exploitation attempts; no confirmed compromises · SecurityWeek

What each outlet adds

beyond the shared facts
  • Rapid7Details temporary mitigations, affected version ranges, and notes remirepo delays.
  • Krebs on SecurityReports Cloudflare WAF deployment time and Ubuntu package updates.
  • SecurityWeekLists vendors seeing exploitation attempts and reveals broken embargo.
  • Cyber Security NewsCites VirusTotal estimate of more than 5.1 million visible PHP hosts.
  • The RecordNotes Detectify estimate that roughly half of PHP sites run unpatched versions.
CVEs
CVE-2026-109618CVE-2026-109619
Vendors
PHPPHP FoundationPHP Group
Products
PHPWordPressDrupalJoomlaMagentoPHP-FPMApache mod_phpFrankenPHPLiteSpeed
Malware
PHP2Shell
Victims
Nintendonoyb
Organizations
CloudflareWizOpenAISANS Internet Storm CenterWatchTowrHadrianCERT-EUMalwarebytesSucuriPatchstackWordfencePHP Foundation
Countries
FinlandFranceNetherlandsGermanyJapanAustraliaUnited Kingdom
AI models
GPT-5.6 Sol

Coverage

oldest first · one row per article · UTC
  1. · 9d ago The RecordFirst report

    Sites go offline as two critical PHP bugs draw early attacks

    Fixes are out only for PHP 8.2 and newer; Cloudflare and watchTowr report emerging attacks dubbed PHP2Shell.

  2. · 9d ago WIRED · Security

    Critical PHP flaws let unauthenticated attackers run code on web servers

    CVE-2026-109618 and CVE-2026-109619 score 9.2; only PHP 8.2 and newer get official patches, and Cloudflare reported early attacks.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109618
+1 related CVE
CVE-2026-109619
OOM longjmp memory flaw enabling RCE in PHP
9.2100%KEVPoC ×25
KEV